forked from
lass.pds.lassul.us/superconfig
This repository has no description
2.7 kB
76 lines
1name: assist-android
2
3# Builds the Android wrapper of the voice page (packages.hermes-voice-android),
4# signs it and publishes it as assist.apk of a new release
5# assist-android-v<run number>, so Obtainium sees every build.
6# Stable URL: https://github.com/lassulus/superconfig/releases/latest/download/assist.apk
7#
8# versionCode is the run number, so every published APK installs over the
9# previous one; versionName is the short commit.
10#
11# Secrets, from the clan var hermes-voice-android-signing on coaxmetal:
12# - ANDROID_KEYSTORE_B64: the keystore, base64
13# - ANDROID_KEYSTORE_PASSWORD: its password
14on:
15 push:
16 branches: [master]
17 paths:
18 - tools/hermes-voice/android/**
19 - tools/hermes-voice/flake-module.nix
20 - flake.lock
21 - .github/workflows/assist-android.yml
22 workflow_dispatch:
23
24permissions:
25 contents: read
26
27# queued, not cancelled: an older run must not publish after a newer one
28concurrency:
29 group: assist-android
30 cancel-in-progress: false
31
32jobs:
33 apk:
34 runs-on: ubuntu-latest
35 permissions:
36 contents: write # release upload
37 steps:
38 - uses: actions/checkout@v4
39
40 - uses: cachix/install-nix-action@v31
41
42 - id: build
43 env:
44 VERSION_CODE: ${{ github.run_number }}
45 run: |
46 unsigned=$(nix build -L --no-link --print-out-paths --impure --expr "
47 (builtins.getFlake \"git+file://$PWD\").packages.x86_64-linux.hermes-voice-android.override {
48 versionCode = $VERSION_CODE;
49 versionName = \"${GITHUB_SHA::8}\";
50 }")
51 echo "apk=$unsigned/hermes-voice-android-unsigned.apk" >> "$GITHUB_OUTPUT"
52
53 - env:
54 KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
55 KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
56 run: |
57 umask 077
58 base64 -d <<<"$KEYSTORE_B64" > "$RUNNER_TEMP/keystore"
59 printf '%s' "$KEYSTORE_PASSWORD" > "$RUNNER_TEMP/password"
60
61 # verifies and prints the certificate as well
62 - env:
63 UNSIGNED: ${{ steps.build.outputs.apk }}
64 run: |
65 nix run .#hermes-voice-android-sign -- \
66 "$RUNNER_TEMP/keystore" "$RUNNER_TEMP/password" "$RUNNER_TEMP/assist.apk" "$UNSIGNED"
67
68 - env:
69 GH_TOKEN: ${{ github.token }}
70 run: |
71 notes="Built from $GITHUB_SHA by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID (versionCode $GITHUB_RUN_NUMBER)."
72 gh release create "assist-android-v$GITHUB_RUN_NUMBER" "$RUNNER_TEMP/assist.apk" \
73 --title "Assist v$GITHUB_RUN_NUMBER" --target "$GITHUB_SHA" --latest --notes "$notes"
74
75 - if: always()
76 run: rm -f "$RUNNER_TEMP/keystore" "$RUNNER_TEMP/password"